Analysis
- max time kernel
124s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 03:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_5037cd08a03189f4d443a05a6c391eb6_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_5037cd08a03189f4d443a05a6c391eb6_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-05_5037cd08a03189f4d443a05a6c391eb6_elex_mafia.exe
- Size 520KB
- Sample260805-dmn6ravsb1
- SHA256 f20c8d67a5800722fc5e2a477d2ac15a2a05788e7685d26fb2595778680c5d2a
- MD5 5037cd08a03189f4d443a05a6c391eb6
- SHA1 911b922f774a452fcc1632d18194b2f6e6fbb9e4
- SHA512 f0e09be089e29b73d9a7f85abf47c7c25672d6c71f582660e9c48b2a1b561257f6968b9634718b872e4e35e63cc5a3461757865f30890ac0b2c88e353252b7de
- SSDEEP 12288:gj8fuxR21t5i8fN/66LONAzlru1Efpqkr947NZ:gj8fuK1GYppLeAzlrHHC7N
- TLSH T1EEB4F1127949C032E4D215304A56EBA20BBABD38976694C73BD03A7E7FB52D2D77430B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4872 F77.tmp 3128 1023.tmp 2996 11D8.tmp 1616 1284.tmp 3176 1321.tmp 3912 139E.tmp 5892 142A.tmp 4320 1515.tmp 5912 15C0.tmp 4092 166C.tmp 6060 1709.tmp 2972 17C4.tmp 3484 188F.tmp 1476 1989.tmp 2076 1A54.tmp 1556 1AF1.tmp 5052 1B7D.tmp 2688 1C68.tmp 1292 1D42.tmp 236 1E1D.tmp 4928 1ED9.tmp 2736 1FC3.tmp 3556 205F.tmp 5828 20FB.tmp 2912 21A7.tmp 1040 2234.tmp 2156 22A1.tmp 3348 236C.tmp 1712 2447.tmp 5860 2512.tmp 3500 25AF.tmp 5404 266A.tmp 2288 2735.tmp 1028 27C2.tmp 3344 282F.tmp 2588 289D.tmp 5680 290A.tmp 4792 2997.tmp 4900 2A04.tmp 2608 2A71.tmp 4984 2AFE.tmp 4484 2B8B.tmp 5532 2C17.tmp 1644 2CA4.tmp 2604 2D50.tmp 2456 2DBD.tmp 1668 2E3A.tmp 1352 2EB7.tmp 3324 2F24.tmp 4212 2FB1.tmp 4428 302E.tmp 3820 30BB.tmp 3064 3147.tmp 5776 31E4.tmp 5144 3261.tmp 3576 32CE.tmp 3696 334B.tmp 4528 33B8.tmp 3304 3435.tmp 1736 3493.tmp 6096 3510.tmp 1724 359D.tmp 3548 360A.tmp 1988 3687.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7209.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5683.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C18C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1709.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 811D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 843A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 889F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 962B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D910.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 570F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8534.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D09F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C92D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 795C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A781.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C55A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A346.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D315.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A23.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3680 wrote to memory of 4872 3680 2026-08-05_5037cd08a03189f4d443a05a6c391eb6_elex_mafia.exe 90 PID 4872 wrote to memory of 3128 4872 F77.tmp 91 PID 3128 wrote to memory of 2996 3128 1023.tmp 92 PID 2996 wrote to memory of 1616 2996 11D8.tmp 93 PID 1616 wrote to memory of 3176 1616 1284.tmp 94 PID 3176 wrote to memory of 3912 3176 1321.tmp 95 PID 3912 wrote to memory of 5892 3912 139E.tmp 96 PID 5892 wrote to memory of 4320 5892 142A.tmp 97 PID 4320 wrote to memory of 5912 4320 1515.tmp 98 PID 5912 wrote to memory of 4092 5912 15C0.tmp 99 PID 4092 wrote to memory of 6060 4092 166C.tmp 100 PID 6060 wrote to memory of 2972 6060 1709.tmp 101 PID 2972 wrote to memory of 3484 2972 17C4.tmp 102 PID 3484 wrote to memory of 1476 3484 188F.tmp 103 PID 1476 wrote to memory of 2076 1476 1989.tmp 104 PID 2076 wrote to memory of 1556 2076 1A54.tmp 105 PID 1556 wrote to memory of 5052 1556 1AF1.tmp 106 PID 5052 wrote to memory of 2688 5052 1B7D.tmp 107 PID 2688 wrote to memory of 1292 2688 1C68.tmp 108 PID 1292 wrote to memory of 236 1292 1D42.tmp 109 PID 236 wrote to memory of 4928 236 1E1D.tmp 110 PID 4928 wrote to memory of 2736 4928 1ED9.tmp 111 PID 2736 wrote to memory of 3556 2736 1FC3.tmp 112 PID 3556 wrote to memory of 5828 3556 205F.tmp 113 PID 5828 wrote to memory of 2912 5828 20FB.tmp 114 PID 2912 wrote to memory of 1040 2912 21A7.tmp 115 PID 1040 wrote to memory of 2156 1040 2234.tmp 116 PID 2156 wrote to memory of 3348 2156 22A1.tmp 117 PID 3348 wrote to memory of 1712 3348 236C.tmp 118 PID 1712 wrote to memory of 5860 1712 2447.tmp 119 PID 5860 wrote to memory of 3500 5860 2512.tmp 120 PID 3500 wrote to memory of 5404 3500 25AF.tmp 121 PID 5404 wrote to memory of 2288 5404 266A.tmp 122 PID 2288 wrote to memory of 1028 2288 2735.tmp 123 PID 1028 wrote to memory of 3344 1028 27C2.tmp 124 PID 3344 wrote to memory of 2588 3344 282F.tmp 125 PID 2588 wrote to memory of 5680 2588 289D.tmp 126 PID 5680 wrote to memory of 4792 5680 290A.tmp 127 PID 4792 wrote to memory of 4900 4792 2997.tmp 128 PID 4900 wrote to memory of 2608 4900 2A04.tmp 129 PID 2608 wrote to memory of 4984 2608 2A71.tmp 130 PID 4984 wrote to memory of 4484 4984 2AFE.tmp 131 PID 4484 wrote to memory of 5532 4484 2B8B.tmp 132 PID 5532 wrote to memory of 1644 5532 2C17.tmp 133 PID 1644 wrote to memory of 2604 1644 2CA4.tmp 134 PID 2604 wrote to memory of 2456 2604 2D50.tmp 135 PID 2456 wrote to memory of 1668 2456 2DBD.tmp 136 PID 1668 wrote to memory of 1352 1668 2E3A.tmp 137 PID 1352 wrote to memory of 3324 1352 2EB7.tmp 138 PID 3324 wrote to memory of 4212 3324 2F24.tmp 139 PID 4212 wrote to memory of 4428 4212 2FB1.tmp 140 PID 4428 wrote to memory of 3820 4428 302E.tmp 141 PID 3820 wrote to memory of 3064 3820 30BB.tmp 142 PID 3064 wrote to memory of 5776 3064 3147.tmp 143 PID 5776 wrote to memory of 5144 5776 31E4.tmp 144 PID 5144 wrote to memory of 3576 5144 3261.tmp 145 PID 3576 wrote to memory of 3696 3576 32CE.tmp 146 PID 3696 wrote to memory of 4528 3696 334B.tmp 147 PID 4528 wrote to memory of 3304 4528 33B8.tmp 148 PID 3304 wrote to memory of 1736 3304 3435.tmp 149 PID 1736 wrote to memory of 6096 1736 3493.tmp 150 PID 6096 wrote to memory of 1724 6096 3510.tmp 151 PID 1724 wrote to memory of 3548 1724 359D.tmp 152 PID 3548 wrote to memory of 1988 3548 360A.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_5037cd08a03189f4d443a05a6c391eb6_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_5037cd08a03189f4d443a05a6c391eb6_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\F77.tmp"C:\Users\Admin\AppData\Local\Temp\F77.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\1023.tmp"C:\Users\Admin\AppData\Local\Temp\1023.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\11D8.tmp"C:\Users\Admin\AppData\Local\Temp\11D8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\1284.tmp"C:\Users\Admin\AppData\Local\Temp\1284.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\1321.tmp"C:\Users\Admin\AppData\Local\Temp\1321.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\139E.tmp"C:\Users\Admin\AppData\Local\Temp\139E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\142A.tmp"C:\Users\Admin\AppData\Local\Temp\142A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\1515.tmp"C:\Users\Admin\AppData\Local\Temp\1515.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\15C0.tmp"C:\Users\Admin\AppData\Local\Temp\15C0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\166C.tmp"C:\Users\Admin\AppData\Local\Temp\166C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\1709.tmp"C:\Users\Admin\AppData\Local\Temp\1709.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Users\Admin\AppData\Local\Temp\17C4.tmp"C:\Users\Admin\AppData\Local\Temp\17C4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\188F.tmp"C:\Users\Admin\AppData\Local\Temp\188F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\1C68.tmp"C:\Users\Admin\AppData\Local\Temp\1C68.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\1D42.tmp"C:\Users\Admin\AppData\Local\Temp\1D42.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\1E1D.tmp"C:\Users\Admin\AppData\Local\Temp\1E1D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\1ED9.tmp"C:\Users\Admin\AppData\Local\Temp\1ED9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\1FC3.tmp"C:\Users\Admin\AppData\Local\Temp\1FC3.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\205F.tmp"C:\Users\Admin\AppData\Local\Temp\205F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\20FB.tmp"C:\Users\Admin\AppData\Local\Temp\20FB.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\21A7.tmp"C:\Users\Admin\AppData\Local\Temp\21A7.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\2234.tmp"C:\Users\Admin\AppData\Local\Temp\2234.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\22A1.tmp"C:\Users\Admin\AppData\Local\Temp\22A1.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\236C.tmp"C:\Users\Admin\AppData\Local\Temp\236C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\2447.tmp"C:\Users\Admin\AppData\Local\Temp\2447.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\2512.tmp"C:\Users\Admin\AppData\Local\Temp\2512.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\25AF.tmp"C:\Users\Admin\AppData\Local\Temp\25AF.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\266A.tmp"C:\Users\Admin\AppData\Local\Temp\266A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\2735.tmp"C:\Users\Admin\AppData\Local\Temp\2735.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\27C2.tmp"C:\Users\Admin\AppData\Local\Temp\27C2.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\282F.tmp"C:\Users\Admin\AppData\Local\Temp\282F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\289D.tmp"C:\Users\Admin\AppData\Local\Temp\289D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\290A.tmp"C:\Users\Admin\AppData\Local\Temp\290A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\2997.tmp"C:\Users\Admin\AppData\Local\Temp\2997.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\2A04.tmp"C:\Users\Admin\AppData\Local\Temp\2A04.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\2A71.tmp"C:\Users\Admin\AppData\Local\Temp\2A71.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\2AFE.tmp"C:\Users\Admin\AppData\Local\Temp\2AFE.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\2B8B.tmp"C:\Users\Admin\AppData\Local\Temp\2B8B.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\2C17.tmp"C:\Users\Admin\AppData\Local\Temp\2C17.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\2D50.tmp"C:\Users\Admin\AppData\Local\Temp\2D50.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\2DBD.tmp"C:\Users\Admin\AppData\Local\Temp\2DBD.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\2F24.tmp"C:\Users\Admin\AppData\Local\Temp\2F24.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\302E.tmp"C:\Users\Admin\AppData\Local\Temp\302E.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\30BB.tmp"C:\Users\Admin\AppData\Local\Temp\30BB.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\3147.tmp"C:\Users\Admin\AppData\Local\Temp\3147.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\31E4.tmp"C:\Users\Admin\AppData\Local\Temp\31E4.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\3261.tmp"C:\Users\Admin\AppData\Local\Temp\3261.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\32CE.tmp"C:\Users\Admin\AppData\Local\Temp\32CE.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\334B.tmp"C:\Users\Admin\AppData\Local\Temp\334B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\33B8.tmp"C:\Users\Admin\AppData\Local\Temp\33B8.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\3435.tmp"C:\Users\Admin\AppData\Local\Temp\3435.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\3493.tmp"C:\Users\Admin\AppData\Local\Temp\3493.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\3510.tmp"C:\Users\Admin\AppData\Local\Temp\3510.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\359D.tmp"C:\Users\Admin\AppData\Local\Temp\359D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\360A.tmp"C:\Users\Admin\AppData\Local\Temp\360A.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\3687.tmp"C:\Users\Admin\AppData\Local\Temp\3687.tmp"65⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\3704.tmp"C:\Users\Admin\AppData\Local\Temp\3704.tmp"66⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\3781.tmp"C:\Users\Admin\AppData\Local\Temp\3781.tmp"67⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\37DF.tmp"C:\Users\Admin\AppData\Local\Temp\37DF.tmp"68⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\384C.tmp"C:\Users\Admin\AppData\Local\Temp\384C.tmp"69⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\38C9.tmp"C:\Users\Admin\AppData\Local\Temp\38C9.tmp"70⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\3937.tmp"C:\Users\Admin\AppData\Local\Temp\3937.tmp"71⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\39C3.tmp"C:\Users\Admin\AppData\Local\Temp\39C3.tmp"72⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"73⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\3ADC.tmp"C:\Users\Admin\AppData\Local\Temp\3ADC.tmp"74⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\3B69.tmp"C:\Users\Admin\AppData\Local\Temp\3B69.tmp"75⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\3BF6.tmp"C:\Users\Admin\AppData\Local\Temp\3BF6.tmp"76⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\3C92.tmp"C:\Users\Admin\AppData\Local\Temp\3C92.tmp"77⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\3D1F.tmp"C:\Users\Admin\AppData\Local\Temp\3D1F.tmp"78⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"79⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\3E28.tmp"C:\Users\Admin\AppData\Local\Temp\3E28.tmp"80⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"81⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"82⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\400D.tmp"C:\Users\Admin\AppData\Local\Temp\400D.tmp"84⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\408A.tmp"C:\Users\Admin\AppData\Local\Temp\408A.tmp"85⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\4107.tmp"C:\Users\Admin\AppData\Local\Temp\4107.tmp"86⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\4193.tmp"C:\Users\Admin\AppData\Local\Temp\4193.tmp"87⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\4201.tmp"C:\Users\Admin\AppData\Local\Temp\4201.tmp"88⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\427E.tmp"C:\Users\Admin\AppData\Local\Temp\427E.tmp"89⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\431A.tmp"C:\Users\Admin\AppData\Local\Temp\431A.tmp"90⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\4397.tmp"C:\Users\Admin\AppData\Local\Temp\4397.tmp"91⤵PID:52
-
C:\Users\Admin\AppData\Local\Temp\4404.tmp"C:\Users\Admin\AppData\Local\Temp\4404.tmp"92⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\4491.tmp"C:\Users\Admin\AppData\Local\Temp\4491.tmp"93⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\450E.tmp"C:\Users\Admin\AppData\Local\Temp\450E.tmp"94⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\457B.tmp"C:\Users\Admin\AppData\Local\Temp\457B.tmp"95⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\4608.tmp"C:\Users\Admin\AppData\Local\Temp\4608.tmp"96⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\4685.tmp"C:\Users\Admin\AppData\Local\Temp\4685.tmp"97⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\46F2.tmp"C:\Users\Admin\AppData\Local\Temp\46F2.tmp"98⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\478E.tmp"C:\Users\Admin\AppData\Local\Temp\478E.tmp"99⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\47FC.tmp"C:\Users\Admin\AppData\Local\Temp\47FC.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\4869.tmp"C:\Users\Admin\AppData\Local\Temp\4869.tmp"101⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\48D7.tmp"C:\Users\Admin\AppData\Local\Temp\48D7.tmp"102⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\4973.tmp"C:\Users\Admin\AppData\Local\Temp\4973.tmp"103⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\49F0.tmp"C:\Users\Admin\AppData\Local\Temp\49F0.tmp"104⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"105⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"106⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\4B86.tmp"C:\Users\Admin\AppData\Local\Temp\4B86.tmp"107⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\4C13.tmp"C:\Users\Admin\AppData\Local\Temp\4C13.tmp"108⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\4C9F.tmp"C:\Users\Admin\AppData\Local\Temp\4C9F.tmp"109⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\4D0D.tmp"C:\Users\Admin\AppData\Local\Temp\4D0D.tmp"110⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\4D99.tmp"C:\Users\Admin\AppData\Local\Temp\4D99.tmp"111⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\4E07.tmp"C:\Users\Admin\AppData\Local\Temp\4E07.tmp"112⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\4E93.tmp"C:\Users\Admin\AppData\Local\Temp\4E93.tmp"113⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\4F20.tmp"C:\Users\Admin\AppData\Local\Temp\4F20.tmp"114⤵PID:504
-
C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"115⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\502A.tmp"C:\Users\Admin\AppData\Local\Temp\502A.tmp"116⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\50A7.tmp"C:\Users\Admin\AppData\Local\Temp\50A7.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\5133.tmp"C:\Users\Admin\AppData\Local\Temp\5133.tmp"118⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\51DF.tmp"C:\Users\Admin\AppData\Local\Temp\51DF.tmp"119⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\525C.tmp"C:\Users\Admin\AppData\Local\Temp\525C.tmp"120⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\52D9.tmp"C:\Users\Admin\AppData\Local\Temp\52D9.tmp"121⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\5366.tmp"C:\Users\Admin\AppData\Local\Temp\5366.tmp"122⤵PID:4612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-